CVE WATCH / VULNERABILITY DETAIL
CVE-2026-89294
HIGHCVSS 7.5NVD feed
Published 30 September 2026 · tracked since 30 September 2026
Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arb
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog